I have query like below, and I want to get this data from user for which I have added a input field called Dsn.
(SourceFile="" OR DestFile="")
here instead of "*", I need to substitute user entered value in the DSN field of UI panel.
Can anyone please help me with this.
sorry but I cannot find "*" in your query, could you use the "Code Sample" button ("101010" button) to highlight you query?
Anyway, if I correctly understood, you have to insert and input field (e.g. a free text but it could be also a dropdown or a multichoice) and than use this token in your search.
So, if your token is called "user", you should try something like this:
In the fieldset section
<fieldset autoRun="true" submitButton="false"> <input type="text" token="user" searchWhenChanged="true"> <label>Enter a username:</label> <default>*</default> </input> </fieldset>
in the search
index=my_index (SourceFile="" OR DestFile="") user=$user$ | ...
I suggest to see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ) where you can find many useful examples.
sorry for inadequate information. Actually, my input must be given in as "text" and that value must be substituted to both source file and destination file.
for eg: if the input am giving is "peacock" this value should be given to both source file and destination file,
like: index=my_index (sourcefile="peacock" OR destinationfile="peacock") .
hope this explains it clearly.
see the Example App to learn how to filter your results.
Anyway, if your token is named "user" try:
index=my_index (SourceFile="$user$" OR DestFile="$user$") | ...
if the token is only a part of the field, you can use wildcards, but it's slower:
index=my_index (SourceFile="*$user$*" OR DestFile="*$user$*") | ...